Privacy Policy

This privacy notice applies to zugtrust.ag, operated by Zugtrust AG, Sinserstrasse 67, 6330 Cham ZG, Switzerland (CHE-100.866.081).

1. Controller

Zugtrust AG. Data protection contact: info@zugtrust.ag.

2. Applicable law

Revised Swiss Federal Act on Data Protection (revFADP / nDSG).

3. Data we process

  • Server logs (IP, user agent, timestamp) — retained max. 30 days.
  • Contact data (company, name, email, phone, requested service, legal form, employee count, VAT status, accounting status, message) — used to handle your request and onboard a mandate.

4. Purposes

  • Replying to enquiries and mandate onboarding.
  • Performing the mandate (bookkeeping, payroll, HR, tax).
  • Operating, securing and improving the site.
  • Compliance with statutory retention obligations (esp. Art. 958f Swiss CO).

5. Recipients

  • Hosting and mail provider: Infomaniak Network SA, Geneva (Switzerland).
  • Authorised personnel and assistants of Zugtrust AG.
  • Authorities, where legally required.

6. Retention

  • Server logs: max. 30 days.
  • Contact data without mandate: deleted at the latest 24 months after last contact.
  • Mandate-related data: retained per statutory obligations (typically 10 years).

7. Cookies

Only technically necessary cookies. No tracking, no analytics, no advertising tags.

8. Your rights

Rights to information, rectification, erasure, data portability and objection. Contact: info@zugtrust.ag.

9. Security

TLS in transit, STARTTLS for mail, access on a need-to-know basis.

10. Data Processing Agreement (DPA / ADV)

Within a bookkeeping, payroll, HR or tax mandate, Zugtrust AG regularly processes personal data of third parties supplied by the Client — in particular employee data (master data, salaries, social-security numbers, withholding-tax tariffs, personnel files), data of the Client's customers, suppliers and other business partners. This processing is carried out on the Client's behalf and instruction within the meaning of Art. 9 revFADP.

By granting the mandate, the Client accepts the following terms as part of the mandate agreement:

  • Subject: processing of personal data exclusively for the purpose of the mandated service.
  • Duration: for the term of the mandate and statutory retention periods.
  • Nature and purpose: collection, storage, structuring, transfer to authorities/social insurances, deletion.
  • Data categories: master data, salary data, bank details, social-security numbers, tax data, personnel files, application documents.
  • Data subjects: employees, applicants, customers and suppliers of the Client.
  • Sub-processors: Infomaniak Network SA (hosting/mail, Switzerland). Further sub-processors (in particular Bexio AG) are disclosed in the mandate offer.
  • Technical and organisational measures (TOM): TLS in transit, STARTTLS for mail, need-to-know access, encrypted backup, access logging.
  • Cooperation and support duties: Zugtrust supports the Client in handling data-subject requests (information, rectification, erasure).
  • Return/deletion: after mandate end, data is returned to the Client in a common format; deletion follows expiry of statutory retention periods.
  • Information and audit rights: the Client may at any time request information on the TOM in place.

A separate DPA annex is included with every mandate offer. Upon request, a standalone DPA contract will be signed.

As of